1. Field of the Invention
This invention relates generally to protective systems for operating systems and more specifically to monitoring and testing the protective system while maintaining protection of the operating system.
2. Description of the Prior Art
In operating systems, such as steam turbine-generator systems, it has been the practice to provide various fault sensors to monitor certain critical conditions of the system such as turbine speed, electrical load, steam pressure, etc. These fault sensors feed this information to cooperating protective systems which, in the event of failure or faulty operation of the operating system, actuate devices which may either correct the condition or shut down the operating system until the cause of the problems can be determined and the necessary repairs to the operating system made.
It has been the practice to provide redundancy in such protective systems so that one component of the system may be tested while a second component protects the operating system. To test a component of the protective system, it has been the practice to feed that component a signal similar to that intended to actuate it in operation, or, in other words to feed it a simulated fault signal. In the prior art, these components were connected in series so that testing one of them would not cause the protective system to sense a fault and actuate the cooperating actuated devices. This was known as a logical AND arrangement because it was necessary for both components to be actuated to complete the circuit. Such prior art protective systems had a significant shortcoming associated with them. In order to trip the prior art protective systems in an actual fault situation it was necessary to trip both of the serially connected components. Therefore, if one of the components failed to function properly by failing to trip, the protective system itself would not trip, and the fault information would not be fed to the devices which either correct the fault or shut the operating system down.
A protective system disclosed in U.S. Pat. No. 3,748,540 overcame this shortcoming associated with such prior art protective systems in that, with the protective system disclosed in that patent, a protective system component could be tested without tripping the operating system and failure of one such component would not cause the protective system to fail to trip so long as the other components of the protective system functioned normally.
However, such prior art protective systems could be rendered totally inoperative if all the system components were locked out (effectively removed from the protective system) for testing.
Therefore, it is an object of the present invention to provide an improved protective system wherein a mistaken attempt to simultaneoulsy lock out both of the redundant components will not cause the protective system to be inoperative.
It is another object of the present invention to provide an improved protective system wherein a testing of one of the redundant components will nevertheless allow the system to be responsive through the remaining component to any actual fault which might occur during such a testing.